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DETAILED ACTION 

1 . This is in response to the Amendment and Remarks filed on 1 1/14/2005. Claims 
1-16 and new claims 17-21 are presented for examination. 

Claim Rejections - 35 USC §112 

2. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and 
distinctly claiming the subject matter which the applicant regards as his invention. 

The term, "substantially" in claims 1, 10, 11, 13, 15 and 16, is a relative term 
which render the claim indefinite. The term "substantially" is not defined by the claim, 
the specification does not provide a standard for ascertaining the requisite degree, and 
one of ordinary skill in the art would not be reasonably apprised of the scope of the 
invention. 

Claim Objections 

3. Claim 1 1 is objected to because of the following informalities: There is unclear 
meaning by the term "communicate respond". For examination purpose, Examiner 
assumes the term to be "communicate to respond". 

Appropriate correction is required. 
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Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

This application currently names joint inventors. In considering patentability of the 

claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the 

various claims was commonly owned at the time any inventions covered therein were 

made absent any evidence to the contrary. Applicant is advised of the obligation under 

37 CFR 1 .56 to point out the inventor and invention dates of each claim that was not 

commonly owned at the time a later invention was made in order for the examiner to 

consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) 

prior art under 35 U.S.C. 103(a). 

5. Claims 1-21 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Spies et al., US pat. No.5,689,565 in view of Scheldt et al., US pat. No.6,754,820. 

As to claim 1, Spies discloses a credential transfer method for use on a distributed 
electronic network, the method comprising the steps of a user causing a sender 
(participant 22a fig. 1 ) communicating to a recipient (Participant 22b fig. 1 ) a credential 
index comprising an index referring to at least one credential (sending and exchanging 
users' credential information), the index including user-provided information about the 
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credential by selecting at least one of the credentials from the index of at least one 
credential provided by the sender (see fig. 1 , abstract, col. 5 line 21 to col.6 line 24 and 
col. 10 lines 10-65), the recipient (22a fig. 1 ) communicating to the sender (22b fig. 1 ) an 
indication of the selected at least one credential and the sender providing to the 
recipient at least one credential corresponding to the selected at least one credential 
(providing secure and credential information between participants, see also fig. 2, col.6 
line 36 to col.7 line 28 and col. 10 lines 10-65). 

Spies does not specifically disclose an index further comprising credential information 
differing substantially from the credential such that the credential is not disclosed by the 
index. However, Scheidt discloses an index further comprising credential information 
differing substantially from the credential (credential that restrict access) such that the 
credential is not disclosed by the index (using selecting "Secret" from the security level 
category as a credential during encryption would limit readership of the encrypted object 
to those who have read access to the "Secret" credential, see fig. 3, col.5 line 31 to col.6 
line 58 and col. 10 lines 10-65). It would have been obvious to one of the ordinary skill 
in the art at the time the invention was made to implement Scheldt's secrete credentials 
into the computer system of Spies to restrict accesses to data information because it 
would have provided sensitivity level or multiple-level access control such that access to 
credentials id dependant on the method of member identification and enforced domain 
authority dictated policies for multiple-level access control by credential category. 



Application/Control Number: 09/955,222 Page 5 

Art Unit: 2151 

As to claim 2, Spies discloses the recipient is a service provider responding to the 
credential index by determining whether the at least one credential is sufficient for the 
recipient to provide a service to the sender and the recipient communicating the result 
of the determination to the sender (see fig. 2, col.7 line 17 to col. 8 line 28 and col.22 
lines 10-64). 

As to claim 3, Spies discloses the recipient responding to the credential index by 
determining a service level according to the at least one credential indexed in the 
credential index and the recipient communicating the service level to the sender (using 
a certified trusted authority 26 fig. 1 to process participant data information, see col.1 line 
17 to col.8 line 28 and col.25 line 7 to coL26 line 41). 

As to claim 4, Spies discloses that the sender communicates a plurality of credential 
indices to the recipient, the number of credential indices exceeding the number of 
credentials (credential index, see fig. 17, col.7 line 17 to col.8 line 28, col. 10 lines 10-65 
and col.26 lines 14-65). 

As to claim 5, Spies discloses the recipient responding to the credential index by 
determining a service level according to each of the plurality of credential indices 
communicated to the recipient by the sender and communicating the service level 
(trusted level) corresponding to at least one of the credential indices to the sender (col.6 
line 36 to col.7 line 45 and col.8 lines 10-56). 
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As to claim 6, Spies discloses that the recipient communicates a service level to the 
sender for each credential index communicated to the recipient by the sender (see fig. 6, 
col.6 line 36 to col.7 line 45 and col.12 lines 1-59). 

As to claims 7-9, Spies discloses that the credential comprising a digital credential, 
indices to a plurality of credentials and the sender selecting a credential index from a 
plurality of available credential indices (see fig.4, col.6 line 36 to col.7 line 45, col.12 
lines 1-59 and col.22 lines 10-63). 

As to claim 10, Spies discloses a method of providing a service over a distributed 
electronic network, comprising: 

a user (22a fig. 1 ) communicating to a service authorizer (credential binding 
server 26 fig. 1) a credential index comprising an index referring to at least one user- 
provided credential about the credential and the service authorizer (26 fig. 1 ) responding 
to the index communicated by the user by selecting at least one of the credentials from 
the index of at least one credential provided by the user (22a fig . 1 ) (sending and 
exchanging credential information, see fig. 1 , abstract, col. 5 line 21 to col.6 line 24). 

the service authorizer responding to the index communicated by the user by 
communicating to the user an indication of the selected at least one credential and the 
user responding to the indication of selected at least one credential by providing to the 
service authorizer at least one credential corresponding to the selected at least one 
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credential and the service authorizer responding to the at least one credential 
corresponding to the selected at least one credential provided to the user (providing 
secure and credential information between participants, see also fig. 2, col.6 line 36 to 
col.7 line 28, col. 10 lines 10-65 and col. 11 line 22 to col. 12 line 63) by determining 
whether the at least one credential provided by the user is sufficient for a service to be 
authorized to be sent by the user, in response to the determination is positive, the 
service authorizer authorizing provision of the service to the user (checking and 
verifying the digital signatures/trusted authority of users, if good, then the first party can 
confirm services can be sent involving the bank, see col.24 line 14 to col. 25 line 19) in 
response to the determination being negative (not sufficient funds), the service 
authorizer taking some other action (returning an authorization response over the 
network to the acquirer, see col. 25 lines 20-53). 

Spies does not specifically disclose an index further comprising credential information 
differing substantially from the credential such that the credential is not disclosed by the 
index. However, Scheidt discloses an index further comprising credential information 
differing substantially from the credential (credential that restrict access) such that the 
credential is not disclosed by the index (using selecting "secret" from the security level 
category as a credential during encryption would limit readership of the encrypted object 
to those who have read access to the "secret" credential, see fig. 3, col. 5 line 31 to col.6 
line 58 and col. 10 lines 10-65). It would have been obvious to one of the ordinary skill 
in the art at the time the invention was made to implement Scheldt's secrete credentials 
into the computer system of Spies to restrict accesses to data information because it 
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would have provided sensitivity level or multiple-level access control such that access to 
credentials id dependant on the method of member identification and enforced domain 
authority dictated policies for multiple-level access control by credential category. 

As to claim 1 1 , Spies discloses a computer readable memory configured so that it 
can be used to direct a computer of a user to: 

communicate respond to the recipient (22a fig. 1 ) a credential index comprising 
an index referring to at least one user provided credential and receive from the recipient 
an indication of at least one credential selected by the recipient from the index (sending 
and exchanging credential information between users, see fig. 1 , abstract, col. 5 line 21 
to col.6 line 24 and col. 10 lines 10-65). 

provide to the recipient (22a fig . 1 ) at least one credential corresponding to the 
selected at least one credential (providing secure and credential information between 
participants, see also fig. 2, col.6 line 36 to col.7 line 28). 

Spies does not specifically disclose an index further comprising credential information 
differing substantially from the credential such that the credential is not disclosed by the 
index. However, Scheidt discloses an index further comprising credential information 
differing substantially from the credential (credential that restrict access) such that the 
credential is not disclosed by the index (using selecting "Secret" from the security level 
category as a credential during encryption would limit readership of the encrypted object 
to those who have read access to the "Secret" credential, see fig. 3, col. 5 line 31 to col.6 
line 58 and col. 10 lines 10-65). It would have been obvious to one of the ordinary skill 



Application/Control Number: 09/955,222 Page 9 

Art Unit: 2151 

in the art at the time the invention was made to implement Scheidt's secrete credentials 
into the computer system of Spies to restrict accesses to data information because it 
would have provided sensitivity level or multiple-level access control such that access to 
credentials id dependant on the method of member identification and enforced domain 
authority dictated policies for multiple-level access control by credential category. 

As to claim 12, Spies discloses a computer readable memory configured so that 
can be used to direct a computer of a service authorizer service to: 

receive from a sender (22b fig. 1 ) a credential index comprising an index referring 
to at least one credential and select from the index received from the sender at least 
one credential (sending and exchanging credential information between users, see fig. 1 , 
abstract, col.5 line 21 to col.6 line 24 and col. 10 lines 10-65). 

enable an action on receipt said at least one credential from the sender 
(providing secure and credential information between participants, see also fig. 2, col.6 
line 36 to col.7 line 28). 

Spies does not specifically disclose an index further comprising credential information 
differing substantially from the credential such that the credential is not disclosed by the 
index. However, Scheidt discloses an index further comprising credential information 
differing substantially from the credential (credential that restrict access) such that the 
credential is not disclosed by the index (using selecting "Secret" from the security level 
category as a credential during encryption would limit readership of the encrypted object 
to those who have read access to the "Secret" credential, see fig. 3, col.5 line 31 to col.6 



Application/Control Number: 09/955,222 Page 10 

Art Unit: 2151 

line 58 and col. 10 lines 10-65). It would have been obvious to one of the ordinary skill 
in the art at the time the invention was made to implement Scheldt's secrete credentials 
into the computer system of Spies to restrict accesses to data information because it 
would have provided sensitivity level or multiple-level access control such that access to 
credentials id dependant on the method of member identification and enforced domain 
authority dictated policies for multiple-level access control by credential category. 

As to claim 13, Spies discloses a processor for generating a digital credential index, the 
index comprising a data structure for providing an index to at least one user provided 
credential (sending and exchanging credential information, see fig. 1 , abstract, col.5 line 
21 to col.6 line 24), whereby at least one credential can be selected on the basis of 
information provided within the data structure (providing secure and credential 
information between participants, see also fig. 2, col.6 line 36 to col. 7 line 28 and col. 10 
lines 10-65). 

Spies does not specifically disclose an index further comprising credential information 
differing substantially from the credential such that the credential is not disclosed by the 
index. However, Scheidt discloses an index further comprising credential information 
differing substantially from the credential (credential that restrict access) such that the 
credential is not disclosed by the index (using selecting "Secret" from the security level 
category as a credential during encryption would limit readership of the encrypted object 
to those who have read access to the "Secret" credential, see fig. 3, col.5 line 31 to col.6 
line 58 and col. 10 lines 10-65). It would have been obvious to one of the ordinary skill 
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in the art at the time the invention was made to implement Scheidt's secrete credentials 
into the computer system of Spies to restrict accesses to data information because it 
would have provided sensitivity level or multiple-level access control such that access to 
credentials dependant on the method of member identification and enforced domain 
authority dictated policies for multiple-level access control by credential category. 

As to claim 14, Spies discloses that the data structure provides indices to a plurality of 
credentials the number of credential indices exceeding the number of credentials (using 
credential index for different level of users, see fig. 17, col. 7 line 17 to col. 8 line 28, 
col.22 lines 10-63 and col.26 lines 14-65). 

Claims 15 and 16 are rejected for the same reasons set forth in claims 1 1 and 12 
respectively. 

As to claims 17 and 20, Spies discloses in response to the recipient deciding that the 
credentials offered in the credential index are not sufficient for the recipient to provide 
the sender with the service, the recipient informs the sender to that effect and in 
response to the recipient informing the sender of the insufficiency, the sender supplies a 
new credential [checking and verifying the digital signatures/trusted authority of users, if 
good, then the first party can confirm services can be sent involving the bank (see 
col. 24 line 14 to col. 25 line 19); if not sufficient funds, returning an authorization 
response over the network to the acquirer (see col.25 lines 20-53). 
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As to claims 18 and 19, Spies discloses in response to the recipient deciding that the 
credentials offered in the credential index are not sufficient for the recipient to provide 
the sender with the service, the recipient informs the sender to terminate the 
communication with the recipient and in response to the determination being 
negative, the other action taken includes information the user to that effect, the user 
responding to the information that the determination is negative by (a) transmitting a 
new credential independent to the service authorizer, or (b) terminating the 
communication with the service authorizer (see col.24 line 14 to col.25 line 19 and 
col.25 lines 20-53). 

As to claim 21, Spies discloses in response to the determination being negative, the 
other action taken including informing the user to that effect, the user responding to 
the information that the determination is negative by (a) transmitting a new credential 
index to the service authorizer, the computer beg programmed to receive the new 
credential index and perform the same steps in response to receipt of the new 
credential index as it performed in response to the earlier credential index (see col.24 
line 14 to col.25 line 19 and col.25 lines 20-53). 

Response to Arguments 

6. Applicant's arguments filed on 1 1/14/2005 have been fully considered but they 
are not persuasive. 
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• Applicant asserts that why one of the ordinary skill in the art at to modify Spies 
with Scheidt. 

In response to applicants argument that why one of the ordinary skill in the art at to 
modify Spies with Scheidt, the fact that applicant has recognized another advantage 
which would flow naturally from following the suggestion of the prior art cannot be the 
basis for patentability when the differences would otherwise be obvious. See Ex parte 
Obiaya f 227 USPQ 58, 60 (Bd. Pat App. & Inter 1985). In this case, the motivation 
that would have provided sensitivity level or multiple-level access control such that 
access to credentials dependant on the method of member identification and enforced 
domain authority dictated policies for multiple-level access control by credential 
category (see Scheldt's col. 2 lines 3-24). 

• Applicant asserts that the Spies reference does not disclose a credential index. 
Examiner respectfully point out that Spies discloses a credential index by 

showing credential levels of user profiles for the purpose of validating users' access 
to data information. For example, Spies discloses the cid is the credential index, 
d.sub.c is the category, x.sub.c is the private key for the credential, y.sub.c is the 
public key for the credential and .lambda. .sub.c is the MLA level defined for the 
credential by the domain authority (see col. 7 line 14 to col. 8 line 63 and col. 10 lines 
10-65). 

Therefore, the examiner asserts that cited prior art teaches or suggests the 
subject matter broadly recited in independent claims 1 , 10, 11, 15 and 16. Claims 2-9, 
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72-74 are also rejected at least by virtue of their dependency on independent claims 
and by other reasons set forth in the previous office action [see paper mailed on 
7/13/2005]. Accordingly, claims 1-16 and new claims 17-21 are respectfully rejected. 

Conclusion 

6. Claims 1-21 are rejected. 

7. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 
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8. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Khanh Dinh whose telephone number is (571) 272- 
3936. The examiner can normally be reached on Monday through Friday from 8:00 A.m. 
to 5:00 P.m. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Zarni Maung, can be reached on (571) 272-3939. The fax phone number 
for this group is (571) 273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free). 




Khanh Dinh 
Primary Examiner 
Art Unit 2151 
1/25/2006 



